2026-09-30 归档

今日共收录 1598 条安全情报，包含 728 个 CVE，467 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-29 发布INFO

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project th...

CVE-2026-71898

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-29 发布INFO

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for wh...

CVE-2026-71897

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-29 发布INFO

Injection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an authenticated user to submit specially crafted input through the web-based administration console.

CVE-2026-4034

Injection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an authenticated user to submit specially c

历史摘要 · 未重新核验 · NVD

#cve #cwe-74

漏洞预警2026-09-29 发布INFO

The decoder in `readFromDataView` in lib0 before 0.2.119 can be tricked into reading more than it should from a buffer. The vulnerability allows reading past the decoders' view,...

CVE-2026-102521

The decoder in `readFromDataView` in lib0 before 0.2.119 can be tricked into reading more than it should from a buffer.

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-09-29 发布INFO

A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process ...

CVE-2026-102360

A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, le

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-09-29 发布INFO

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check write tracking in all address spaces kvm_gfn_is_write_tracked() checks only the supplie...

CVE-2026-98164

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check write tracking in all address s

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-29 发布INFO

Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.

CVE-2026-96869

Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-29 发布INFO

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. ...

CVE-2026-82804

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharac

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-29 发布INFO

PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityParserCreate function that allows attackers to corrupt mem...

CVE-2026-76875

PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityP

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-09-29 发布INFO

OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSeek-Reasonix (Reasonix Studio) allows a local attacker who controls repository...

CVE-2026-102437

OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSeek-Reasonix (Reasoni

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-29 发布INFO

OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.

CVE-2026-101271

OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) t

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-09-29 发布INFO

Malicious HTML content could be injected into the help texts of various fields with organizer permissions.

CVE-2026-101270

Malicious HTML content could be injected into the help texts of various fields with organizer permissions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-29 发布INFO

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since...

CVE-2026-101269

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same s

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-09-29 发布INFO

If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this mig...

CVE-2026-101268

If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's custo

历史摘要 · 未重新核验 · NVD

#cve #cwe-384

漏洞预警2026-09-29 发布INFO

A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information i...

CVE-2026-101267

A missing permission check allowed low-privileged users with access to an event but without access to the event's orders

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-29 发布INFO

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Firefox ESR 115.42, and Firefox ESR 140.17.

CVE-2026-100832

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Firefox ESR 115.4

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-09-29 发布INFO

Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.

CVE-2026-100831

Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox ESR 153.4 and F

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-09-29 发布INFO

Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.

CVE-2026-100830

Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-29 发布INFO

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.

CVE-2026-100829

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-29 发布INFO

Mitigation bypass in the Bookmarks & History component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.

CVE-2026-100828

Mitigation bypass in the Bookmarks & History component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 15

历史摘要 · 未重新核验 · NVD

#cve